PHP detect if page is reloaded with PHP_SELF

Question

I have a form that reloads the page with the updated data:

<form name="form" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
    ...
    <input type="submit" name="Submit" value="Update data">
</form>

When the page is updated I want to display a message "Data updated". There was something like this with Referer I beleve, but can't remember.

btw I am also using:

if (isset($_POST['Submit'])) {
    // prevent resending data
    header("Location: " . $_SERVER['PHP_SELF']);
}

to avoid the annoying resending data message when the user clicks the back button. Is this correct?

Answer 1

You can just use what you're using pretty much:

if (isset($_POST['submit'])) {
    echo "data submitted";
}

Why not do that?

Answer 2

A generally accepted way to prevent the "resend data" message is to use the Post-Redirect-Get pattern.

Ideally you shouldn't be using the same page to display results and also process the form. I would suggest moving "Data updated" to a separate page that you redirect to after the form validation has passed.

This way, the Back button on the browser behaves intuitively for the user without those annoying messages.

Also, technically the $_SERVER "referer" value can be spoofed so you shouldn't always rely on it.

Answer 3

If you want to be absolutely sure that a form was submitted, you can store a variable in a session:

session_start();      // at top of page
...
if (isset($_POST['Submit'])) {
    $_SESSION['form_submitted'] = true;
    ...
    // prevent resending data
    header("Location: " . $_SERVER['PHP_SELF']);
}
elseif ($_SESSION['form_submitted'])
{
    ...
}

Less reliable but also possible is the use of $_SERVER['HTTP_REFERER'] to detect what page the visitor came from.

Answer 4

You could do something like this ...

a. redirect to self, but with an extra piece of information - "?updated=true" (or *&*updated=true if PHP_SELF already contains a query string)

if (isset($_POST['Submit'])) {
    // prevent resending data
    header("Location: " . $_SERVER['PHP_SELF'] . '?updated=true');
}

b. Based on this extra information, display the text.

if (isset($_GET['updated'])) {
    echo "data updated";
}

... and yes, your redirect is a valid way to prevent resubmision